ElectronJS: Sign And Notarize Your MacOS Application

ElectronJS: Sign And Notarize Your MacOS Application

That’s a hard topic actually. A few years back Apple decided that all distributions have to be notarized in order to be able to be flawlessly installed on your Mac. Otherwise your end-users will get an error similar to this:

To get rid of this error, your app needs to be signed, then it will have to go through notarization procedure, which is done on the Apple side. Thanks to electron-builder this tidies process could be simplified, but still there are a lot of steps to be done.

1. You’d need a paid developer account. Just visit developer.apple.com to find out on how to apply
2. Once you are done with setting your account, you would need to generate required certificates. Before that go to https://www.apple.com/certificateauthority/ and download root CA certificates and Developer ID — G2 certificate. Install them into your keychain.
3. Go to https://developer.apple.com/account/resources/certificates/list and follow all the steps to generate Mac Installer Distribution certificate and Distribution certificate. Another (and more preferable way) is to do this via Xcode. Just run your Xcode and go to Settings->Accounts->Manage Certificates then click on “+” sign. Select Distribution and another run Mac Installer Distribution
4. In your keychain make sure, that your newly obtained certificates are trusted with the green sign in it. If it says that they aren’t valid, then you would have to do steps 2 and 3 again with a little bit of googling, which CA is missing. If both certificates are green and healthy, you need to export them into single p12 file (thanks to Andrew) :

if p12 is grayed out you need to select first tab “My Certificates” then select both and export. Name it as MacCodeSignBundle.p12 give it some password _your_certificatepass and place it into the root directory of your app

5. Go to appstoreconnect.apple.com and create new distribution for your app. The most important would be the app ID which will be something like com.yourdomain.yourapp

6. Go to developer.apple.com/account/resources/profiles/list and create a new provisioning profile. Make sure it’s Distribution->App Store Connect (not Development). Download the file into your app’s root directory. PS if you have’t added your device as trusted, you may do it here: https://developer.apple.com/account/resources/devices/list

7. I’m assuming that you are using electron-builder. In that case you DON’T NEED to install any other packages as Electron Builder already embodies all the necessary tools. You just need to fill up a few fields. Here is the example of my “mac” build section:

...
  "mac": {
        "appId": "com.yourdomain.yourapp",
        "icon": "Appicon.icns",
        "target": "mas",
        "identity": "YourCompany, Inc (<TEAM ID HERE>)",
        "category": "public.app-category.productivity",
        "hardenedRuntime": true,
        "gatekeeperAssess": false,
        "notarize": false,
        "extendInfo": {
            "NSAppleEventsUsageDescription": "Please allow access to script browser applications to detect the current URL when triggering instant lookup.",
            "NSUserNotificationAlertStyle": "alert",
            "CFBundleURLTypes": [{
                "CFBundleTypeRole": "Viewer"
            }]
        },
        "provisioningProfile": "yourapp.provisionprofile",
        "entitlements": "entitlements.mac-sandbox.plist",
        "entitlementsInherit": "entitlements.mac-sandbox.plist"
    },
...

Pay attention to appId, identity, target, provisioningProfile, entitlements and entitlementsInherit. If anything will go wrong then you can blame these fields.

a. appId — should match your distribution ID b. identity — the name of your certificate. Usually matches the name of your developer account followed with enclosed with parenthesis team ID c. provisioningProfile — path to your yourapp.provisionprofile file that you have downloaded in step 6 d. entitlements and entitlementsInherit — create file entitlements.mac-sandbox.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>TEAM_ID_HERE.com.yourdomain.yourapp</string>
    </array>
  </dict>
</plist>

You need to have com.apple.security.app-sandbox set as true

e. target — when you distribute your app from your own premises the most convenient way is to set target as “dmg”, but for Apple Store it has to be “mas”

Transporter

Open your Mac App Store and look up for Transporter app. Once installed run it with your Apple Developer credentials

Build your App

Create your app password (please Google this one, I’ve lost the link) and copy the secret. Now try to run

export CSC_LINK=MacCodeSignBundle.p12 CSC_NAME="YourCompany, Inc (_TEAM_ID_HERE_)" CSC_KEY_PASSWORD=_your_certificate_pass_ APPLE_ID=_YOUR_DEV_EMAIL_ APPLE_APP_SPECIFIC_PASSWORD='_YOUR-APP-PASS-WORD_' && electron-builder --mac

electron-builder -mac part may vary depending on your package.json “script” section.

If your command runs without any issues and ended up with something like: signing file=dist/mas/yourapp.app platform=mas type=distribution id…

Than means you got lucky today and you are ready to upload your app. Launch you Transporter.app and select your .pkg file (look up for it in your build directory). If everything was set right, your upload should go through and your file will appear in your app review. Congratulaions!